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(57) Abstract 

The present invention relates to determining the geographic location of a mobile station in a mobile communications system. The 
object of the invention is to protect the integrity of the user of the mobile station, so as to prevent the location of the mobile station being 
established by an outsider against the will of the user. In this respect, an authorization check is carried out in conjuction with a request for 
determination of the geographical location of a mobile station. The geographical location is only determined when authorization is found 
for the mobile station to be located. This authorization control involves checking that the user of the mobile station has granted permission 
for the location of his mobile station MS to be determined on the part of an outsider. The authority check may also include the condition 
that only certain outsiders may be informed of the geographical location of the mobile station. 
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INTEGRITY PROTECTION IN A TELECOMMUNICATIONS SYSTEM 



FIELD OF INVENTION 

5 

The present invention relates to a telecommunications 
system especially one that includes a mobile 
communications system and a mobile locating means with 
which the geographical location of a terminal in the 
10 mobile communications system can be determined. 

BACKGROUND OF THE INVENTION 

The manner in which the geographical location of a mobile 
15 station in a mobile communications system can be 
determined is described in a large number of patent 
specifications . 

Some patent specifications, for instance SE 9500569-0, 
20 Europolitan, describes a procedure with which the 
location of a mobile station is determined by the 
American GPS system. This requires the mobile station to 
be also equipped with a GPS terminal. A GPS terminal can 
determine its geographical location, by receiving signals 
25 from at least three satellites. An inquiry from a third 
party concerning the location of the mobile station can 
be sent over the mobile communications system and handled 
by the mobile station without involving its user. The 
location of the mobile station is then sent back over the 
30 network to the person requesting the information. 

In the majority of these solutions, the measurements 
necessary for establishing the location of the mobile 
station are carried out by the mobile communications 
35 system instead. For instance, Patent Specification SE 
9603561-3, Bodinl, describes how the wave propagation 
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time of a signal from the mobile station is measured in a 
base station. The wave propagation time is corresponded 
by a distance. The measuring process is repeated at two 
more base stations. The location of the mobile station 
5 can then be established on the basis of the measuring 
results and on the knowledge of the geographical 
locations of the base stations. According to this prior 
patent specification, the calculation is made in a mobile 
locating node belonging to the mobile communications 
10 system. 

Alternatively, the wave propagation time of a signal sent 
from a base station may be measured in the mobile 
station. This method is described in Patent Specification 
15 U.S. 5,293, 645, Sood, among others. After having measured 
the wave propagation from at least three base stations, 
the mobile station reports the result to the land based 
part of the mobile communications network. 

20 It is also mentioned in SE 9500569-0 that the 
geographical location of a mobile station can be 
determined through the identity of the cell within which 
the mobile station is located. It is the mobile 
communications system that is able to obtain the cell 

25 identity information. This method can only provide a 
rough indication of the location of the mobile station, 
since the indicated cell may well have a radius in the 
order of tens of kilometres. 

30 Patent Specification SE 9700522-7, Bodin2, describes how 
a mobile locating command can be sent from a mobile 
locating node outside the mobile communications system to 
the mobile switching centre that manages the mobile 
station. The switching centre is assumed to control the 

35 base station system to carry out measurements that will 
determine the location of the mobile station with the aid 
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of some earlier known measuring method. The mobile 
locating node provides a mobile locating service, in 
which it receives orders from a customer concerning the 
location of a certain mobile station, orders the 
5 switching centre to carry out a measuring procedure, 
receives the measuring result, and calculates the 
location of the mobile and then presents the result to 
the customer. A modified short message service (SMS) is 
used to send the command to the switching centre and to 
10 send the measuring result from the switching centre to 
the mobile locating node. 



None of the aforementioned patent specifications draws 
attention to the encroachment of the integrity of a user 
15 of a mobile station when an outsider is able to establish 
the geographical location of the user. 

SUMMARY OF THE INVENTION 



20 The present invention addresses the problem of an 
outsider being able to establish the geographical 
location of a mobile station with the aid of a mobile 
locating service. Determination of the geographical 
location of a mobile constitutes a problem when it takes 

25 place against the wishes of the mobile user. 

Another problem addressed by the invention is when the 
user of the mobile station may wish an outsider to be 
informed of his location on certain occasions while 
keeping the possibility of preventing an outsider from 

30 being informed of his location on other occasions. 



Another problem is one when the user may wish for a 
person of his choice to be informed of his location while 
denying this possibility to other persons. 



35 
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Accordingly, an object of the present invention is to 
protect the integrity of a mobile user, such as to 
prevent outsiders from determining the location of the 
mobile with the aid of a mobile locating service. Another 
5 object is to provide a flexible integrity protection 
service which enables the geographical location of the 
mobile to be determined when the user so desires or when 
it is in the user's interest for the location of the 
mobile to be determined. 

10 

The aforesaid problems are solved in accordance with the 
present invention, by providing the mobile communications 
system with an indicator. The indicator is set either to 
indicate that the user permits the location of the mobile 

15 to be determined, i.e. a permission granted state, or to 
a state in which the user does not permit the location of 
the mobile to be determined, i.e. permission not granted 
state. Before determining the location of a mobile, a 
check is made to ascertain whether or not the indicator 

20 is in its permission granted state. If not, the location 
determining process is discontinued. The user of the 
mobile is able to set the indicator to the state desired. 
In one embodiment: the subscriber, i.e. the owner of the 
subscription which may be different than the current 

25 user, has the possibility to prevent someone who is using 
the subscriber's mobile station MS from changing the 
indicator . 

According to one alternative embodiment, the user of the 
30 mobile receives a request for permission to determine the 
location of his mobile. This embodiment can be suitably 
used when the user himself has requested from a service 
provider a service that is dependent on the geographical 
location of the user. The service provider contacts a 
35 mobile locating node and asks to be told of the location 
of the mobile station. The mobile locating node asks the 
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user for permission to determine the location of the 
mobile. The user gives his permission directly to the 
mobile locating node. Alternatively, the user gives his 
permission to the mobile locating node via the service 
5 provider. This is effected by sending to the service 
provider a code that the user has received together with 
the permission request, wherewith the service provider 
sends the code to the mobile locating node. The location 
of the mobile is determined when the code received agrees 
10 with the code sent together with the request. 

In addition to checking the permission indicator, a check 
can also be made to ascertain whether or not the person 
requesting determination of the location of the mobile is 

15 registered and that authorization for this person to 
establish the location of the sought mobile is also 
registered, said checks being carried out before 
determining the location of the mobile. In this case, 
registration of this information is a condition for 

20 allowing the location of the mobile to be determined. 

This information is stored in a register connected to or 
integrated with the mobile locating node. 

The invention provides the advantage of enabling the user 
25 of a mobile station to prevent the geographical location 
of the mobile being established and divulged. The 
invention can be applied in a number of different forms 
that are suited for different situations. For instance, 
this enables a haulage contractor to establish the 
30 locations of its own mobile stations regularly and in a 
simple manner, while, at the same time, preventing others 
from establishing the locations of said mobiles. It also 
enables a private user to prevent the location of his 
mobile station being determined while, at the same time, 
35 enabling the user to establish his own location on 
certain occasions when needed by the user. The various 
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embodiments of the invention thus enable the integrity of 
the user to be protected in a flexible manner. 

The invention also has the advantage of being adapted for 
5 the administrative structure in the mobile communications 
system. It is essential to adapt to the existing 
structure, so as not to increase the complexity of the 
mobile communications system. The introduction of the 
indicator in the mobile communications system enables the 
10 user to set the indicator to the state desired directly 
and involves a only minor modification of the mobile 
communications system. 

The invention will now be described in more detail with 
15 reference to preferred exemplifying embodiments thereof 
and also with reference to the accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

20 Fig- 1 illustrates a mobile communications system in 
which a mobile locating node is connected. 

Fig. 2 is a block schematic illustrating a mobile 
communications system in which a short message is 
25 transmitted. 

Fig. 3 illustrates a modified home location register. 

Fig. 4 is a flowchart illustrating a state checking 
30 procedure in conjunction with a mobile locating process. 

Fig. 5 is a flowchart that illustrates an alternative 
procedure in which authorization checks are carried out 
in conjunction with a mobile locating process in addition 
35 to an indicator check- 
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Fig, 6 is a flowchart illustrating an inventive method of 
checking mobile locating permission, suitable for use in 
conjunction with the user requesting a location-dependent 
service from a service provider. 

5 

Fig. 7 is a flowchart illustrating an alternative method 
of checking for permission to locate a mobile in the same 
situation as that intended with respect to the method 
illustrated in Fig. 6. 

10 

Fig. 8 is a flowchart illustrating another alternative 
method of checking whether or not permission to determine 
the location of a mobile has been given, in the same 
situation as that intended for the method illustrated in 
15 Fig. 6. 

Fig. 9 illustrates the format of a request for routing 
information, sent by the GMSC to the home location 
register . 

20 

DESCRIPTION OF PREFERRED EMBODIMENTS 

The present invention enables the user of a mobile 
station to prevent an outsider from learning of his 
25 geographical location with the aid of a mobile locating 
service . 

Fig. 1 illustrates one such mobile communications system 
GSM. It is managed by an Operator. The mobile 

30 communications system GSM includes a number of mobile 
stations MS, MS1-MS3. A user Al of the mobile station MS 
moves freely and is able to communicate via the mobile 
communications system GSM provided that he is located 
within the service area of the GSM system. The service 

35 area is divided into a number of cells CL1-CL3. Located 
in each cell CL1-CL3 is a respective radio base station 
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BTS1-BTS3 that can maintain connection with the mobile 
stations MS , MS1-MS3 within the cell. A number of radio 
base stations BTS1-BTS3 communicate with a base station 
controller BSC, said base station controller BSC 
5 communicating, in turn, with a mobile services switching 
centre MSC . The mobile communications system GSM includes 
at least one GMSC (Gateway Mobile Switching Centre) P 
which communicates with the remaining mobile switching 
centres MSC of the mobile communications system. The GMSC 

10 P also communicates with a home location register HLR. 

Each mobile station MS, MS1-MS3, with an subscription to 
the mobile communications system GSM is registered in the 
home location register HLR. Also visiting mobile stations 
with subscriptions in other mobile communications systems 

15 are temporarily registered in the home location register 
HLR. The home location register HLR contains data as to 
the whereabouts of the mobile stations MS, MS1-MS3 as 
well as visiting mobile stations. In addition to the home 
location register HLR, the mobile communications system 

20 GSM includes a further subscriber location register, i.e. 

a visitor location register VLR, containing data relating 
to the mobile station MS. The visitor location register 
VLR is connected to the mobile services switching centre 
MSC. 

25 

The mobile communications system GSM is designated the 
land based part of the mobile communications network, 
with the exception of the mobile station MS and the radio 
connection thereto. 

30 

The system shown in Fig. 1 includes a mobile locating 
node MPC connected to the GMSC P. The mobile locating 
node MPC provides a mobile locating service, which means 
that the node MPC will establish the location of a mobile 
35 station MS, MS1-MS3 in response to a request from a 
second party A2 in this respect and inform this second 
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party of the geographical position of said mobile 
station. To this end, there is found a connection between 
the second party A2 and the mobile locating node MPC, via 
which the mobile locating node receives the location- 
5 finding request Ml and informs the second party of the 
location of the mobile station in a response M2 . 

Fig. 2 is a block schematic illustrating an inventive 
arrangement. In addition to those nodes also shown in 

10 Fig. 1, the arrangement includes an indicator I provided 
in the home location register HLR. The user Al is able to 
set the indicator I to indicate either one of two states, 
i.e. a permission granted state or a permission not- 
granted state. The user Al sets the indicator to the 

15 desired state, by stating a code CD via the mobile 
station. The code CD is sent from the mobile station as 
though it were a B-number, i.e. the number of a B- 
subscriber dialled for a call connection. When the code 
CD has been transferred to the GMSC P, the GMSC P 

20 identifies the code CD as a message to the home location 
register HLR and not as a standard B-number. The GMSC 
therefore sends the code CD to the home location register 
HLR. The home location register HLR then sets the 
indicator to indicate the desired integrity level. 

25 

The code CD may be either one of two character 
combinations denoting either that determining of the 
location of the mobile is allowed or not allowed. These 
two character combinations may be *99# and *98#. The 
30 transfer of this code to and its registration in HLR are 
effected analogously with how the call forwarding service 
is utilized from the mobile station MS. 

Fig. 2 illustrates with the aid of an arrow the transfer 
35 of a mobile locating command Kl from the location . node 
MPC to the mobile services switching centre MSC via the 
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GMSC P. The command Kl is described more explicitly 
further on in the text. 

Fig. 3 shows a home location register HLR that has been 
5 modified by the inclusion of the indicator I. Data 
concerning the mobile station MS are stored in a number 
of different information fields in the home location 
register HLR. The information fields are found with the 
aid of the mobile station identity DA, among other 
10 things. A further information field for storing the 
indicator I is included on the home location register, as 
shown in Fig. 3. 

Fig. 4 is a flowchart illustrating one embodiment of the 
15 inventive method, where a second party A2 desires 
information concerning the location of the mobile station 
MS. In a first step Bl, the second party A2 sends a 
request Ml to the mobile locating node MPC asking to be 
informed of the whereabouts of the mobile station MS. 

20 

The mobile locating node MPC then sends a command Kl to 
the mobile switching centre MSC that serves the mobile 
station MS at that moment in time. The purport of the 
command Kl is for the switching centre MSC to collect 
25 locational data relating to the mobile station MS and 
send it to the mobile locating node MPC, in accordance B2 
in Fig. 4.? The command Kl is sent in the form of a 
modified SMS message addressed to the mobile station MS, 
as described in SE 9700522-7. 

30 

The command Kl reaches the mobile communications system 
via the GMSC P, which identifies the command Kl as being 
a location-finding command. The GMSC P asks the home 
location register HLR for routing information, so as to 
35 be able to forward the command Kl . The GMSC P indicates 
in the request that the routing information is intended 
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for a mobile locating command Kl . Upon receipt of the 
request, the home location register HLR reads the 
register HLR indicator I and provides the requested 
routing information, provided that the indicator 
5 indicates that it is allowed to divulge the geographical 
location of the mobile. This is corresponded by a step B3 
in Fig. 4, i.e. the step in which the mobile locating 
state of the indicator is checked. If mobile locating is 
allowed, i.e. Yes to the question in step B3 of Figure 4, 
10 the command Kl is forwarded to the GMSC P to the mobile 
switching centre MSC . 

The switching centre begins to collect locational data 
relating to the mobile station MS, upon receipt of the 
15 command Kl . The collected locational data is then sent to 
the mobile locating node MPC, in accordance with step B4 . 

The mobile locating node MPC then establishes the 
location of the mobile station MS with the aid of the 
20 locational data received, and presents the result to the 
second party A2 in a message M2, in accordance with step 
B5. 

Should the answer to the question in step B3 be No, 
25 locating of the mobile is not allowed, as is the case 
when the indicator I in the home location register HLR 
indicates that location-finding is not allowed, no mobile 
locating procedure is carried out. Instead a message is 
sent to the mobile locating node MPC to the effect that 
30 permission to divulge the location of the mobile station 
MS is not given, in accordance with step B6. Instead of 
sending routing information, the home location register 
HLR sends a message to the GMSC P to the effect that the 
information requested cannot be given, because divulgence 
35 of the location of the mobile station MS is not 
permitted. GMSC P sends to the mobile location node MPC a 
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message to the effect that the location of the mobile 
station MS has not been determined because permission is 
lacking . 

5 The mobile locating node MPC then sends a message to the 
second party A2 to the effect that the location of the 
mobile station MS cannot be divulged, because permission 
is lacking in this respect, in accordance with step B7 . 

10 Fig. 5 illustrates an alternative embodiment of the 
method for checking whether or not establishment of the 
location of the mobile station MS is permitted. The 
procedure followed in accordance with this method is 
similar to the procedure followed according to Fig. 4, 

15 but with the difference that authorization checks are 
carried out on the second party A2 . 

The procedure followed in accordance with Fig. 5 is 
commenced with a step Bl , similar to the procedure 
20 described in Fig. 4, in which the second party A2 sends a 
message Ml requesting the geographical location of the 
mobile station MS. 

A check is then run to ascertain whether or not the 
25 second party A2 is known to the mobile locating node MPC, 
in accordance with a following step C2 . One reason for 
this check is to be able to bill the second party for the 
mobile locating service. If the second party A2 is known, 
i.e. the answer to the query in step C2 is Yes, step C3 
30 is carried out. 

In step C3, a check is run to ascertain whether or not 
the second party A2 is entitled to be informed of the 
location of the mobile station MS. In order to be 
35 entitled to check the mobile station MS, this entitlement 
must have earlier been registered in the mobile locating 
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node MPC. If the check shows that the second party is 
entitled to be informed of the geographical position of 
the mobile, i.e. the answer to the question in step 3 is 
yes, step C4 is carried out. 

5 

In step C4, a check is run to ascertain whether the 
mobile locating request has been made in an emergency 
situation. An emergency situation can be reported, for 
instance, by the second party saying as such in 
10 conjunction with the mobile locating request, and by the 
second party indicating that it has an alarm centre 
status- In the event of an emergency, i.e. the answer to 
the question in step C4 is Yes, step C6 is carried out. 

15 On the other hand, if the answer to the question in step 
C4 is No, i.e. there is no emergency, a check is run to 
ascertain whether the indicator 1 shows that the user Al 
permits the location of his mobile station MS to be 
determined in accordance with step C5 . This check is 

20 carried out by the mobile locating node MPC sending a 
query as to whether or not it is allowed to locate the 
mobile station MS. This permission query is received by 
the GMSC P and forwarded to the home location register 
HLR. The home location register HLR deals with the query 

25 and the GMSC P sends the answer to the mobile locating 
node MPC. If the answer is Yes, locating the mobile 
station MS is allowed, step C6 is carried out. 
According to step C6, a command Kl to locate the position 
of the mobile station MS is sent from the mobile locating 

30 node MPC to the mobile switching centre MSC. The 
indicator I is not checked when the command Kl is 
transmitted in the case of this embodiment. 

The switching centre MSC collects mobile station MS 
35 locational data. The obtained mobile station MS 
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locational data is then sent to the mobile locating node 
MPC, in accordance with step C7 . 

The mobile station MS location data may optionally be 
5 further processed in the mobile locating node MPC, 
whereafter the location of the mobile station MS is 
established and presented to the second party A2 in a 
message M2, in accordance with step C8 in Fig. 5. 

10 If, as distinct to what has been assumed in the 
aforegoing, the second party A2 is not registered in the 
mobile locating node MPC or it is found that said second 
party is not entitled to information revealing the 
location of the mobile station MS concerned, or if the 

15 indicator I shows that divulgence of the location of said 
mobile station MS is not allowed, in other words the 
answer to any of the questions asked in step C2, C3 or C5 
is No, the location of the mobile station MS is not 
determined and the mobile locating node informs the 

20 second party to this effect and gives the reasons why, in 
accordance with C9 . 

The procedure described in Fig. 5 includes two further 
authorization checks, in addition to checking whether or 

25 not the second party A2 is known (step C2) . The first of 
these authority checks is made in accordance with step 
C3, in order to ascertain whether or not the second party 
A2 is entitled to be told of the location of precisely 
the mobile station to which his request is directed. For 

30 instance, a firm of haulage contractor has the right to 
know the locations of its own mobile stations, but does 
not have the right to know the geographical location of a 
mobile station belonging to a competitor. When the second 
party is an alarm centre, i.e. has the telephone number 

35 112 in the case of Sweden, it can be given the right to 
be told of the locations of all mobile stations. 
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It is also possible to divide the right to know the 
locations of mobile stations in accordance with different 
authority gradings . For instance, a low priority in this 
5 respect may mean that the second party A2 may only be 
told within which part of the country the mobile station 
MS is located. 

The second of these authority checks is carried out in 
10 accordance with step C5, with the purpose of ascertaining 
whether or not the user has given his permission for the 
location of his mobile station to be determined. For 
instance, an employee Al of the aforesaid haulage 
contractor may allow the location of his mobile station 
15 MS to be determined at the beginning of his work shift. 
This employee may wish to deny his employer the 
possibility of establishing his location at the end of 
his shift and, therefore, withdraws his permission, by 
setting the indicator I to a state which indicates that 
20 permission is not granted. 



In an optional addition to any of the embodiments with 
reference to fig. 4 and fig. 5 the user Al can change the 

25 indicator I only if the subscriber has given his 
permission to change the indicator I. In most cases the 
user and the subscriber are the same person, but in some 
cases they are different persons. One example is the firm 
of haulage contractors being the subscriber of a 

30 subscription associated with the mobile station MS. The 
mobile station MS is attached to a truck driven by an 
employee of the firm. 

In addition to the indicator I a subscriber indicator SI 
is implemented. A field for storing the indicator I in 
35 the home location register HLR is shown in fig. 3 by 
dashed lines. The subscriber indicator SI can be set into 
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two states. The first state is the grant state, which 
indicates that the subscriber grants the location of the 
mobile station MS to be determined. The grant state of 
the subscriber indicator SI overrides the indicator I. 
5 The second state is the zero state, which indicates that 
the state of the indicator I is decisive. 

The previous described inventive methods are modified in 
that before checking the state of the indicator I, 

10 according to step B3 and step C3, the subscriber 
indicator SI is checked. If the subscriber indicator SI 
is in the grant state the method is continued by step B4 
or alternatively step C4 without checking the indicator 
I. If instead the state of the subscriber indicator SI 

15 is zero, the indicator I is checked and the further step 
is dependent on the state of the indicator I, in the same 
way as in the previous described inventive methods. 

The subscriber indicator SI is controlled by the operator 
20 of the mobile communication system. The subscriber gives 
his instructions on the desired state of integrity to the 
operator. The operator sets the subscriber indicator SI 
or alternatively the additional states of the indicator I 
to the desired level by a man machine interface of the 
25 node in which the indicator is located, for instance the 
home location register HLR. 



30 According to a further option the state of subscriber 
indicator SI is changed at predefined times. The change 
is made by a state control module in the mobile 
communication system. The state control module includes a 
clock and data program module. It is programmed by the 

35 operator to change the state at times predefined by the 
subscriber . 
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By this further option the firm of haulage contractors 
can prevent the employed truck driver from changing the 
state of the indicator I during his work period. Thereby 
5 the firm can locate the truck in which the mobile station 
MS is mounted during the work period. When the working 
period is finished the indicator I can be changed by the 
driver to prevent the location from being determined if 
the firm has instructed the operator that the indicator I 
10 is changeable at that time. 

Alternatively the subscriber indicator can be set into 
three states instead of two. The third state is a 
subscriber not grant state, with the effect that the 
15 mobiles stations MS position will not be determined 
whatever the state of the indicator I . 

In a further optional addition to the embodiment of the 
invention illustrated by fig. 5 determination of the 

20 location of the mobile station MS prohibited. In a nation 
there are a few people whose security is of extra 
interest, for instance a president of the nation. An 
operator solely cannot be entrusted to prevent the 
location of a president's mobile station MS from being 

25 determined, especially since it should be unknown to the 
operator which of all mobile stations belongs to the 
president . 

30 For this purpose a secured integrity function is supplied 
by for instance a secret service of the nation. The 
secured integrity function includes a list of the mobile 
stations whose locations shall be prohibited from being 
determined. The list is optionally encrypted. The secured 

35 integrity function also includes means for receiving and 
answering an inquiry for permission to determine the 



WO 98/52379 



18 



PCT/SE98/00803 



location of a specified mobile station. The response on 
the inquiry will be negative if the specified mobile 
station MS is included in the list. 

The secured integrity function is created under control 
of the secret service. If the included list is encrypted 
the means for reading it includes encryption keys. The 
secured integrity function is delivered to the operator 
who can not read the list or the encryption keys. The 
operator connects the secured integrity function to the 
mobile communication system. Alternatively the operator 
downloads a program module into one of the nodes of the 
mobile communcation system, for example the home location 
register. The secured integrity function can 
alternatively be connected to or downloaded into the 
mobile location centre MPC. 

In the previous described method with reference fig 5 is 
modified in that in the step C3 in fig 5 is also the 
inquiry to the optional secured integrity function 
added. If the response on the inquiry is No, the location 
of the mobile station MS is excluded from being divulged, 
step C9 will be performed. In step C9 the second party is 
informed that the location of the mobile station is not 
divulged. The second party is not informed that this is 
due to the fact that permission to locate is being 
prohibited by the secured integrity function. If instead 
the response on the inquiry is Yes, step C4 will be 
executed. 

Another embodiment of the invention can be used ideally 
when the user Al of the mobile station MS contacts a 
service provided A2 and requests a service therefrom, in 
order to carry out the service, the service provider A2 
needs to know of the geographical whereabouts of the user 
Al. This service may involve a route description or the 
whereabouts of the nearest hamburger restaurant. 
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Fig. 6 is a flowchart that illustrates this procedure. 
The user Al initially contacts the service provider A2 
and requests a service for which the geographical 
5 location of the user Al is a necessary integral. This 
commencement of the procedure is shown by step El in Fig. 
6. 

The service producer A2 then sends to the mobile locating 
10 node MPC a request Ml asking for the location of the 
mobile station, in accordance with a following step E2 . 

The mobile locating node MPC then checks whether or not 
the service provider A2 has earlier been registered. 
15 Although this step is designated E3 in Fig. 6, it follows 
the same procedure as that followed in step C2 in Fig. 5. 
If it is found that the service provider A2 is 
registered, i.e. the answer to the question in E3 is Yes, 
a step E4 is carried out. 

20 

In step E4, the mobile locating node MPC contacts the 
user Al of the mobile station MS and asks the user Al for 
his permission to determine the location of the mobile. 
The identity of the service provider A2 can be given to 
25 the user Al together with the request. The user Al gives 
his permission for the location of the mobile station MS 
to be determined, i.e. Yes to the question in step E4, by 
sending his permission to the mobile locating node MPC 
via his mobile station MS, in accordance with step E5 . 

30 

The mobile locating procedure is commenced when the 
mobile locating node MPC has received approval, wherewith 
the location of the mobile station MS is determined in 
accordance with step E6. This is achieved by sending a 
35 command Kl to the mobile switching centre that collects 
mobile station MS location data, and sends this data back 
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to the mobile locating node MPC . The mobile locating node 
MPC then sends to the service provider A2 a message M2 in 
which the location of the mobile station MS is revealed. 

5 If the mobile locating node MPC does not receive 
permission from the user Al, i.e. the question put in 
step E4 results in a No, or if the service producer A2 is 
not registered in the mobile locating node MPC, i.e. a No 
to the question asked in step E3, the mobile locating 
10 procedure is broken-off and the mobile locating node MPC 
sends a message M2 to the service provider A2 in 
accordance with step E7 . The message M2 informs that the 
location of the mobile station MS cannot be determined 
and the reason why. 

15 

In addition to checking whether or not the service 
provider A2 is registered, a check is also run in step E3 
on the identity of the service provider A2 . This check 
may, for instance, require the service provider A2 to 
20 give a code word that is specific to this provider, and 
to obtain authorization to be informed of the location of 
the mobile station. 

Fig. 7 illustrates another embodiment of the invention 
25 that is suitable for use when the user Al requests a 
mobile station MS-location related service from the 
service provider A2 . The first three steps El, E2 and E3 
of the procedure are the same as those in the procedure 
illustrated in Fig. 6. In these steps, the user Al 
30 requests the service provider A2 to provide the service, 
the service provider contacts the mobile locating node 
MPC to find out the location of the user Al, and the 
mobile locating node MPC checks that the service provider 
A2 is registered. 



35 
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If it is found that the service provider A2 is 
registered, i.e. Yes to the question in step E3, the 
mobile locating node MPC sends a request to the user Al 
of the mobile station MS asking for permission to 
determine his location, in accordance with step F4 . A 
password is sent together with the request. The user 
gives permission for his location to be determined, i.e. 
says yes to the question in F4 , by sending the password 
to the service provider A2, in accordance with step F5. 



The service provider A2 sends the password to the mobile 
locating node MPC in accordance with step F6 . The mobile 
locating node MPC then checks that the password received 
from the service provider A2 agrees with the password 
15 sent to the mobile station MS. This latter procedure is 
carried out in step F7 in Fig. 7. When the passwords are 
found to agree with one another, the location of the 
mobile station MS is determined and the service provider 
A2 informed of said location, in accordance with step F8 . 

20 

On the other hand, if the service provider A2 is not 
found to be registered, or no password is sent to the 
mobile locating node MPC from the mobile station via the 
service provider, or should the password received not 

25 agree with the password that was sent by the mobile 
locating node MPC, i.e. a negative response to any of the 
questions raised in steps E3, F4 or F7 , the location of 
the mobile is not determined and the service provider A2 
is informed of the reason why, in accordance with step 

30 F9. 



The procedures carried out in steps F8 and F9 in Fig. 7 
correspond to the procedures carried out in respective 
steps E6 and E7 in Fig. 6. 
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Fig. 8 illustrates a further alternative embodiment 
suitable for use in conjunction with the user Al 
requesting a mobile station MS location dependent service 
from a service provider A2 . The procedure followed in 
5 accordance with this method differs from the procedures 
illustrated in Fig. 6 and Fig. 7 by virtue of the fact 
that the user Al need not actively express permission for 
the location of his mobile station MS to be determined in 
response to the request from the service provider A2 . 

10 

The procedure followed in the method illustrated in Fig. 
8 is commenced with the same three steps El, E2 and E3 as 
those with which the procedures illustrated in Fig. 6 and 
Fig. 8 are commenced. According to these steps, the user 

15 Al first contacts the service provider A2 who then 
contacts the mobile locating node MPC and asks to be told 
of the location of the user Al . After the mobile locating 
node MPC has ascertained that the service provider A2 is 
known, i.e. Yes in step E3, there follows a first step G4 

20 which distinguishes the method of Fig. 8 from the methods 
of the two preceding Figures . 

In step G4, it is checked that a connection has been set 
up between the mobile station MS and the service provider 
25 A2 . If it is found that a connection has been set up, 
i.e. the answer to the question in step G4 is Yes, the 
procedure in step G5 is carried out. 

In step G5 f it is checked that the indicator I in the 
30 mobile communications system indicates that the user Al 
has given his permission for the location of the mobile 
station MS to be determined. Step G5 in Fig. 8 
corresponds to step C5 in Fig. 5. Step G6 is carried out 
when the indicator I indicates that the user has given 
35 his permission, i.e. Yes to the question raised in step 
G5. 
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In step G6, the mobile locating node MPC sends to the 
mobile switching centre MSC a command Kl to determine the 
location of the mobile station MS. 

5 

Mobile station MS location data is sent in a following 
step G7 to the mobile locating node MPC, which 
establishes the location of the mobile station MS and 
sends a message M2 that reveals the location of the 
10 mobile station MS to the service provider A2 . 

On the other hand, should the service provider A2 not be 
found to be registered with the mobile locating node MPC 
or that no connection has been set up between the service 

15 provider A2 and the mobile station MS or the indicator I 
shows that the user has not given permission for the 
location of his mobile station MS to be determined, i.e. 
a No to any one of the questions in respective steps E3, 
G4 or G5, the location of the mobile station MS will not 

20 be determined and the mobile locating node MPC informs 
the service provider A2 to this effect in a message M2, 
in accordance with step G8 . 

In step C2 in Fig. 5 and in step E3 in Fig. 6, Fig. 7 and 
25 Fig. 8, a check is run to ascertain whether or not the 
second party A2 is registered in the mobile locating node 
MPC. This step can be omitted from the described 
embodiments, if so desired. One reason for omitting step 
C3 and step E3 respectively may be because the second 
30 party A2 can be billed without prior registration in the 
mobile locating node MPC. 

The steps G5, G6, G7 and G8 are corresponded by the steps 
C2, C5, C6, C7, C8 and C9 in Fig. 5. 

35 
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In the Fig. 2 illustration and in the described 
embodiments, the indicator I is placed in the home 
location register HLR. However, the indicator I may be 
placed in any other of the system nodes, for instance in 
5 the gateway MSC, referenced P, the visitor location 
register VLR, the mobile services switching centre MSC, 
or in the mobile station MS. The indicator I can 
alternatively be placed in the mobile locating node MPC. 
The mobile location node MPC should the preferably be 

10 managed by the operator. 

When placed in the mobile station, the indicator I will 
be stored in a memory intended for this purpose. The user 
sets the indicator I to indicate either that permission 
to locate the mobile station MS is granted or is not 

15 granted, via the standard user interface. The mobile 
locating node MPC checks the indicating state of the 
indicator I, by sending a query to the mobile station MS 
regarding permission to locate the whereabouts of a 
mobile station- This query and the response received can 

20 be sent to and from the mobile station MS in a number of 
ways. For instance, it is possible to use both a modified 
radio interface between the mobile station and the base 
station controller BSC together with a MAP protocol, USSD 
(Unstructured Supplementary Service Data) and short 

25 messages. Both the query and the mobile station MS are 
modified so that the query regarding the state of the 
indicator is answered by the mobile station without 
involving the user. 

30 

If the optional subscriber indicator SI is implemented 
the indicator and the subscriber indicator I shall 
preferably be implemented in node fully controlled by the 
operator, i.e. not in the mobile station MS. 
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The present invention is not concerned with the manner in 
which data is collected. In the af oredescribed 
embodiments, it is the mobile switching centre MSC that 
5 is responsible for data collection. This data collection 
can include the switching centre being responsible for 
determining the location of the mobile station, for 
instance by measuring the wave propagation delay between 
the mobile station MS and one or more of the base 
10 stations BTS1-BTS3. Data collection can alternatively 
require the mobile switching centre to disclose the 
traffic area within which the mobile station MS is 
located. A traffic area is comprised of one or more cells 
CL1-CL3. 

15 

Alternatively, data collection can be effected at a node 
other than the mobile switching centre MSC. This other 
node may, for instance, be the base station controller 
BSC, the mobile station MS, or at the mobile station MS. 
20 In this latter case, the mobile station MS will be 
equipped for collecting mobile station MS location data, 
such equipment being a GPS terminal. 

In the af oredescribed examples, the command Kl concerning 
25 the location of a mobile station is sent with the aid of 
a modified short message. A mobile locating command Kl 
can be sent to the node responsible for collecting mobile 
locating data in a number of ways. The possibilities 
given by way of example for transmitting a query 
30 concerning permission to determine the location of a 
mobile station MS when the indicator I is placed in the 
mobile station MS can also be used to send a mobile 
locating command Kl . 

35 In the Fig. 1 illustration, the mobile locating node MPC 
is connected to the mobile communications system GSM by 
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connection with the GMSC P. However, the mobile locating 
node MPC can be connected in other ways. For instance, it 
can be connected to the home location register HLR. An 
alternative solution is to include the mobile locating 
5 node MPC as an integrated part of one of the nodes of the 
mobile communications system, for instance an integrated 
part of the GMSC P. 

Fig. 1 shows the mobile locating node MPC free-standing 
10 from the mobile communications system GSM. It is, 
however, possible to extend the specification for the 
mobile communications system GSM to include the same 
functions as those of the af oredescribed mobile locating 
node. The functions of the mobile locating node MPC are 
15 to receive the mobile locating request Ml, to ascertain 
whether or not the location of the mobile station MS may 
be disclosed (in several embodiments) , to send a mobile 
locating command Kl, to receive mobile station MS 
location data, to optionally further process mobile 
20 station MS location data, and to divulge the location of 
the mobile station MS to the second party A2 . 

In a number of cases and in a number of mobile 
communications networks GSM, the GMSC P manages the 
25 duties of the mobile switching centre MSC. In Fig. 1, 
these are shown as separate units since this is the most 
common form. 

In the first method shown in Fig. 4, the command Kl is 
30 sent with a modified short message. The manner in which 
the short message shall be modified is described in the 
earlier patent application SE 9700522-7. However, SE 
9700522-7 does not describe how the GMSC P in connection 
with a routing info request shall inform the home 
35 location register HLR that the request shall be used to 
determine the location of a mobile station MS. 
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In GSM terminology, this request for information sent by 
the GMSC P to the home location register HLR is 
designated "Send Routing Info For Short Message". This 
5 request is described by specification GSM 09.02. 

Fig. 9 illustrates in principle the format of the routing 
info request SRI sent by the GMSC P to the home location 
register HLR. The request SRI has a number of different 

10 information fields, of which only a few are shown in Fig. 
9. One of these information fields MSISDN includes the 
identity of the mobile station MS. Another field, SCA, 
identifies the sender. The request SRI shown in Fig. 9 
has been modified by adding a further information field 

15 P_req to the request SRI. This additional information 
field P_req indicates to the home location register HLR 
that the routing info request shall be used for locating 
the location of a mobile station MS. 

20 When the home location register HLR receives a modified 
routing info request SRI, it checks whether or not the 
indicator is in a mobile locating state. When such a 
state is indicated, the home location register sends 
routing information. The information is sent in a message 

25 entitled "Short Message Routing Information Message", see 
specification GSM 09.02. 

Fig. 1 illustrates the inventive method as carried out in 
a cellular mobile communications system. It will be 

30 understood, however, that the invention is not restricted 
to application in a cellular mobile communications system 
and that the invention can be applied in all 
telecommunications systems in which the users are mobile. 
By being mobile is meant that a subscriber is not tied to 

35 a certain electric wall plug or socket but that a 
terminal with associated subscription can be used for 
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both incoming and outgoing traffic within a wide 
geographical area. 
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1. A method of protecting the location integrity of a 
mobile station (MS) in a telecommunications system, said 

5 mobile station being managed by a first party (Al), 
wherein the method requires 

a public communications system (GSM) in which said 
mobile station is included; and 

- a mobile station locating node (MPC) which upon request 
10 initiates a procedure for determining the location of the 
mobile station, receives location data, and divulges the 
location of the mobile station (MS) , wherein 

a) the mobile locating node (MPC) receives from a second 
party (A2) a first message (Ml) asking to be informed of 

15 the geographical location of the mobile station (MS) ; and 
wherein the method is characterized by the further steps 
of: 

b) reading an authorization parameter which indicates 
whether or not the first party (Al) allows the location 

20 of the mobile station to be determined; and 

c) sending from the mobile station locating node (MPC) a 
second message (M2) in the form of a response to said 
request, said response being dependent on said 
authorization parameter . 

25 

2. A method according to Claim 1, characterized in that 
said public communications system (GSM) is a public 
mobile communications system (GSM) . 

30 3. A method according to Claim 1 or 2 , characterized in 
that the authorization parameter is shown by an indicator 
(I) in the public communications system (GSM). 

4. A method according to Claim 3, characterized in that 
35 said indicator (I) is connected to the mobile station 
(MS) . 
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5. A method according to Claim 3, characterized in that 
said indicator (I) is connected to the land-based part of 
the network (P, MSG, HLR, VLR, BSC, BTS) of the mobile 

5 communications system. 

6. A method according to Claim 3, characterized in that 
said indicator (I) is connected to a subscriber location 
register (HLR, VLR) . 

10 

7. A method according to Claim 1 or Claim 2, 
characterized in that the request according to step a) is 
preceded by the first party (Al) contacting the second 
party (A2) . 

15 

8. A method according to Claim 1, Claim 2 or Claim 6, 
characterized in that an authorization parameter is set 
by the first party (Al) via the mobile station (MS) . 

20 9. A method according to any one of Claims 1-8, 
characterized in that a condition for disclosing the 
location of the mobile station in response to the request 
according to step c) is that the authorization parameter 
denotes that determination of the location of the mobile 

25 station is permitted. 

10. A method according to Claim 7, wherein the second 
party (A2) is equipped with a tele terminal , characterized 
in that the authorization parameter is set to show that 
30 the location of the mobile station can be revealed to the 
second party (A2) provided that a connection is set up 
between the mobile station (MS) and the teleterminal of 
said second party (A2). 

35 11. A method according to Claim 10, characterized in 
that the authorization level of an indicator in the 
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public communications system is read and that the 
location of the mobile station (MS) is disclosed provided 
that the indicator indicates permission for the location 
of the mobile station to be determined. 

12. A method according to any one of the preceding 
Claims, characterized by reading a register, wherein a 
condition for disclosing the location of the mobile 
station in response to the request according to step d) 
is that the register contains an authorization for the 
second party (A2) to be informed of the location of the 
mobile station. 

13. A method according to Claim 1 or Claim 2, 
characterized in that in step b) an inquiry is made to a 
secured integrity function whereupon the secured 
integrity function gives a positive or a negative 
respond. 

14. A method according to any one of Claims 3, 4, 5, 6 
or 11, characterized in that said indicator (I) can be 
set by the first party (Al) to indicate a desired 
integrity level from the mobile station (MS) . 

15. A method according to any one of Claims 3, 4, 5, 6 
or 8, characterized in that reading according to step b) 
is effected by the mobile station locating node (MPC) 
sending a third message, an authorization parameter 
request, to a first node (MS, HLR, VLR) to which said 
indicator is connected, and in that a fourth message 
containing authorization parameter information is sent to 

, the mobile station locating node (MPC) . 

16. A method according to Claim 1, 2, 9, 11 or 12, 
wherein a location data collecting means is connected to 
a second node (P, MSC, BSC, BTS, MS) in the public 
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communications system (GSM) , characterized in that the 
mobile station locating node (MPC) sends to the second 
node a command ordering the second node to collect 
location data relating to the mobile station (MS) 
5 provided that it is permitted to disclose the location of 
the mobile station. 

17. A method according to Claim 4, 5 or 6, wherein a 
location data collecting means is connected to a second 

10 node (MSG, MS) in the mobile communications system, 
characterized in that the mobile station locating node 
(MPC) sends to said second node a command ordering the 
second node to collect mobile station location data, 
wherewith said indicator is read and mobile station 

15 location data is collected depending on the authorization 
parameter shown. 

18. A method according to Claim 15, characterized by 
using a short message service for sending the aforesaid 

20 third message requesting an authorization parameter and 
receiving said fourth message containing authorization 
parameter information . 

19. A method according to Claim 15, characterized by 
25 using a data transfer service for sending said third 

message requesting an authorization parameter, and 
receiving a fourth message containing said authorization 
parameter information . 

30 20. A method according to any one of the preceding 
Claims, characterized in that the method is carried out 
in a GSM mobile communications system. 

21. A method of protecting the location integrity of a 
35 mobile station (MS) in a telecommunications system, said 
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mobile station being associated with a subscription 
belonging to a subscriber, wherein the method requires 
- a public communications system (GSM) in which said 
mobile station is included; and 
5 - a mobile station locating node (MPC) which upon request 
initiates a procedure for determining the location of the 
mobile station, receives location data, and divulges the 
location of the mobile station (MS), wherein 

a) the mobile locating node (MPC) receives from a second 
10 party (A2) a first message (Ml) asking to be informed of 

the geographical location of the mobile station (MS) ; 

and wherein the method is characterized by the further 
steps of: 

15 

b) reading an subscriber indicator (SI) which indicates 
whether or not the subscriber grants the location of said 
mobile station to be determined; and 

c) sending from the mobile station locating node (MPC) a 
20 second message (M2) in the form of a response to said 

request, said response being dependent on said 
authorization parameter. 

22. A method according to Claim 21, wherein a user (Al) 
25 is using said mobile station (MS) characterized in 

depending on the state of the subscriber indicator (SI) 
reading an indicator (I), indicating whether the user 
allows the location of the mobile station MS to be 
determined, whereupon said reponse being dependent on 
30 said indicator (I) . 

23. A method according to Claim 21, characterized in that 
said public communications system (GSM) is a public 
mobile communications system (GSM) . 
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24. A telecommunications system arrangement for 
providing mobile station (MS) integrity, said mobile 
station being managed by a first party, wherein the 
arrangement includes 

5 a public communications system (GSM) in which the 

mobile station (MS) is included; and 

- a mobile station locating node (MPC) in connection with 
the public communications system and including means for 
receiving a request for determining the location of the 

10 mobile station, means for initiating a procedure for 
determining the location of the mobile station, means for 
receiving mobile station location data, and means for 
revealing the location of said mobile station (MS) , 
characterized by 

15 - an indicator (I) which indicates integrity level and is 
included in the mobile communications system; 

- means for reading the integrity level; and 

means for responding to the request in accordance with 
the read integrity level. 

20 

25. An arrangement according to Claim 24, characterized 
in that said public communications system (GSM) is a 
public mobile communications system (GSM) . 

25 26. An arrangement according to Claim 24 or Claim 25, 
characterized by means for transferring an integrity 
level query message from the mobile station locating node 
(MPC) to a first node to which the indicator (I) is 
connected (P, MSC, BSC, MS), means in the first node for 

30 reading the integrity level, and means for sending an 
integrity level message from the first node to the mobile 
station locating node. 

27. An arrangement according to any of the Claims 24, 25 
35 or 26, characterized in that the indicator (I) is, 
connected to a subscriber location register (HLR, VLR) . 
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28. An arrangement according to any of the Claims 24, 25 
or 26, characterized in that the indicator (I) is 
connected to the mobile station (MS) . 

5 

29. An arrangement according to Claim 24 or Claim 25, 
characterized in that the indicator (I) is encompassed by 
a subscriber location register (HLR, VLR) ; and in that a 
request to the subscriber location register (HLR, VLR) 

10 for routing information is modified with information to 
the effect that said request is a mobile station locating 
request . 

30. An arrangement according to Claim 24 or Claim 25, 
15 characterized by means for setting the indicator (I) to a 

desired integrity level from the mobile station. 

31. An arrangement according to Claim 27, characterized 
by means for transferring the desired integrity level 

20 message (CD) from the mobile station (MS) to the 
subscriber location register (HLR, VLR) . 

32. A mobile station MS, characterized in that it 
includes an integrity level indicator (I) . 

25 

33. A mobile station MS according to Claim 32, 
characterized in that the indicator either indicates that 
permission to determine the location of the mobile 
station is granted or not granted. 

30 

34. A mobile station MS according to Claim 32 or 33, 
characterized by means for causing the indicator to 
indicate the desired integrity level from the user 
interface . 

35 
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35. An arrangement according to any one of Claims 24-34, 
characterized in that the public communications system 
(GSM) is a GSM system. 

5 36. A telecommunications system arrangement for 
providing mobile station integrity, said mobile station 
being managed by a first party, wherein the arrangement 
includes 

a public communications system (GSM) in which the 
10 mobile station is included; and 

- a mobile station locating node (MPC) in connection with 
the public communications system and including means for 
receiving a request for determining the location of the 
mobile station, means for initiating a procedure for 

15 determining the location of the mobile station, means for 
receiving mobile station location data, and means for 
revealing the location of said mobile station (MS), 
characterized by 

- a secured integrity function , in which the identity of 
20 said mobile station (MS) is registered if its location is 

excluded from being determined; 

- means to inquire the secured integrity function for 
permission to determinelocation for said MS; and 

means for responding to the request in accordance with 
25 the respond on said inquiry. 

37. An arrangement according to Claim 36, characterized 
in that said said list is encrypted and that said secured 
integrity function includes the encryption key. 

30 38. An arrangement according to Claim 36, characterized 
in that said public communications system (GSM) is a 
public mobile communications system (GSM) . 
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